Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection. In the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters. (Citation: Bastille April 2017) (Citation: Zack Whittaker April 2017)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Remote Terminal Unit (RTU)
is related to Distributed Control System (DCS) Controller
is related to Human-Machine Interface (HMI)
is related to Programmable Logic Controller (PLC)
is related to Intelligent Electronic Device (IED)
is related to Data Gateway
is related to Control Server
is related to Programmable Automation Controller (PAC)
is related to Data Historian
is related to Safety Controller
is blocked by Software Process and Device Authentication
is blocked by Filter Network Traffic
is blocked by Network Segmentation
is blocked by Network Allowlists
is blocked by Detection of Rogue Master
is blocked by Communication Authenticity
Impressum Deutsch Englisch